Secrets: Add namespace matches checks to authorizer and secure value client (#109651)

* Decrypt: Add namespace matches to authorizer

* SecureValueClient: Add namespace matches when auth checking

pkg/registry/apis/secret/secure_value_client.go

@@ -265,8 +265,17 @@ func (c *secureValueClient) mapError(err error, name string) error {
 }
 
 func (c *secureValueClient) checkAccess(ctx context.Context, name, verb string) error {
+	authInfo, ok := claims.AuthInfoFrom(ctx)
+	if !ok {
+		return apierrors.NewUnauthorized("missing auth info in context")
+	}
+
 	gr := secretv1beta1.SecureValuesResourceInfo.GroupResource()
 
+	if !claims.NamespaceMatches(authInfo.GetNamespace(), c.namespace) {
+		return apierrors.NewForbidden(gr, name, fmt.Errorf("namespace mismatch: %s != %s", authInfo.GetNamespace(), c.namespace))
+	}
+
 	decision, reason, err := c.access.Authorize(ctx, authorizer.AttributesRecord{
 		Verb:            verb,
 		Namespace:       c.namespace,